NATS nats-server before 2.9.23 and 2.10.x before 2.10.2 has an authentication bypass.
Priority LOW 30CWE-863Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-863.
Summary
NATS nats-server before 2.9.23 and 2.10.x before 2.10.2 has an authentication bypass. An implicit $G user in an authorization block can sometimes be used for unauthenticated access, even when the intention of the configuration was for each user to have an account. The earliest affected version is 2.2.0.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00825 57th percentileScored 2026-11-07
Fix Fixed github.com/nats-io/nats-server/v2 (Go): 2.9.23, 2.10.2
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | github.com/nats-io/nats-server/v2 (Go) | 2.2.0 to before 2.9.23 | 2.9.23 | Patch available | GHSA-fr2g-9hjm-wr23 |
| — | github.com/nats-io/nats-server/v2 (Go) | 2.10.0 to before 2.10.2 | 2.10.2 | Patch available | GHSA-fr2g-9hjm-wr23 |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- github.com/nats-io/nats-server/v2 (Go) Vendor— Affected 2.2.0 to before 2.9.23 Fixed in 2.9.23 Patch available GHSA-fr2g-9hjm-wr23
- github.com/nats-io/nats-server/v2 (Go) Vendor— Affected 2.10.0 to before 2.10.2 Fixed in 2.10.2 Patch available GHSA-fr2g-9hjm-wr23
Remediation
- Fix · GHSA-fr2g-9hjm-wr23 github.com/nats-io/nats-server/v2 (Go) Fixed in 2.9.23 Advisory →
- Fix · GHSA-fr2g-9hjm-wr23 github.com/nats-io/nats-server/v2 (Go) Fixed in 2.10.2 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2023-47090
- 2026-10-03 Alias added: GHSA-fr2g-9hjm-wr23
- 2026-10-06 EPSS moved to the 50th–90th percentile
References
Other 9
- https://www.openwall.com/lists/oss-security/2023/10/13/2
- [oss-security] 20231030 Re: NATS: 2023-01: Adding accounts for just the system account adds auth bypass
- https://github.com/nats-io/nats-server/pull/4605
- https://github.com/nats-io/nats-server/commit/fa5b7afcb64e7e887e49afdd032358802b5c4478
- https://advisories.nats.io/CVE/secnote-2023-01.txt
- https://github.com/nats-io/nats-server
- https://github.com/nats-io/nats-server/discussions/4535
- https://github.com/nats-io/nats-server/releases/tag/v2.10.2
- https://github.com/nats-io/nats-server/releases/tag/v2.9.23
More backstage Nats-server vulnerabilities
- TI-2026-22233 NATS: Pre-auth remote server crash via WebSocket frame length overflow in wsRead CVSS 3.1HIGH 7.5
- TI-2022-11116 NATS nats-server 2.2.0 through 2.7.4 allows directory traversal because of an unintended… CVSS 3.1CRITICAL 9.8
- TI-2020-16319 The JWT library in NATS nats-server before 2.1.9 has Incorrect Access Control because of… CVSS 3.1CRITICAL 9.8
- TI-2026-25637 NATS has MQTT plaintext password disclosure CVSS 3.1HIGH 8.6
- TI-2022-08320 NATS nats-server before 2.7.2 has Incorrect Access Control. CVSS 3.1HIGH 8.8
- TI-2026-41950 NATS Server: Pre-auth server crash via double INFO in leafnode handshake CVSS 3.1HIGH 7.5
Sources
- CVE-2023-47090 · CVE Program
- CVE-2023-47090 · NVD
- FIRST EPSS
- GHSA-fr2g-9hjm-wr23 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences